A Blockchain-Assisted Ensemble Learning Model for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Industrial Cyber–Physical Systems support real-time industrial operations, where inaccurate or tampered anomaly scores are serious concerns. Many conventional approaches focus on anomaly detection and do not address tamper-resistant logging of the detection decisions. This paper presents a blockchain-assisted ensemble anomaly detection framework that combines Isolation Forest, One-Class Support Vector Machine, and a Sparse Attention Autoencoder. The detected scores are normalized using causal sliding-window normalization and they are combined using F2 score-based weighted fusion. The fusion weights are calibrated on a small labelled validation subset excluded from the test data. For every detected event, the decision evidence is deterministically serialized, hashed using SHA-256, grouped into Merkle batches, and committed asynchronously to append-only Ethereum smart contract. Experiments are conducted with the Secure Water Treatment (SWaT) dataset over 50 repeated runs. Our approach achieves a point-wise F1-score of 0.805 ± 0.012, a false positive rate of 0.05 ± 0.01, an AUC-ROC of 0.94 ± 0.01, and detection of 88 ± 3% of the 35 attack segments. The mean critical path latency measured on the test workstation included 24.46 ms per observation, within the 1s SWaT sampling interval. The proposed approach outperforms the individual detectors and the blockchain layer offers tamper-evident verification of committed records in local Ethereum test environment.